mirror of
https://github.com/Mbed-TLS/mbedtls.git
synced 2025-07-30 22:43:08 +03:00
Merge pull request #5263 from ronald-cron-arm/psa-test-driver_3.x
Forward port to 3.x: Introduce PSA test driver library to test PSA configuration
This commit is contained in:
Gilles Peskine
GitHub
@ -1553,15 +1553,176 @@ component_test_no_use_psa_crypto_full_cmake_asan() {
|
||||
env OPENSSL_CMD="$OPENSSL_NEXT" tests/compat.sh -e '^$' -f 'ARIA\|CHACHA'
|
||||
}
|
||||
|
||||
component_test_psa_crypto_config_basic() {
|
||||
# Test the library excluding all Mbed TLS cryptographic support for which
|
||||
# we have an accelerator support. Acceleration is faked with the
|
||||
# transparent test driver.
|
||||
msg "test: full + MBEDTLS_PSA_CRYPTO_CONFIG + as much acceleration as supported"
|
||||
scripts/config.py full
|
||||
scripts/config.py set MBEDTLS_PSA_CRYPTO_CONFIG
|
||||
component_test_psa_crypto_config_accel_ecdsa () {
|
||||
msg "test: MBEDTLS_PSA_CRYPTO_CONFIG with accelerated ECDSA"
|
||||
|
||||
# Disable ALG_STREAM_CIPHER and ALG_ECB_NO_PADDING to avoid having
|
||||
# partial support for cipher operations in the driver test library.
|
||||
scripts/config.py -f include/psa/crypto_config.h unset PSA_WANT_ALG_STREAM_CIPHER
|
||||
scripts/config.py -f include/psa/crypto_config.h unset PSA_WANT_ALG_ECB_NO_PADDING
|
||||
|
||||
# SHA384 needed for some ECDSA signature tests.
|
||||
scripts/config.py -f tests/include/test/drivers/config_test_driver.h set MBEDTLS_SHA384_C
|
||||
scripts/config.py -f tests/include/test/drivers/config_test_driver.h set MBEDTLS_SHA512_C
|
||||
|
||||
loc_accel_list="ALG_ECDSA ALG_DETERMINISTIC_ECDSA KEY_TYPE_ECC_KEY_PAIR KEY_TYPE_ECC_PUBLIC_KEY"
|
||||
loc_accel_flags=$( echo "$loc_accel_list" | sed 's/[^ ]* */-DLIBTESTDRIVER1_MBEDTLS_PSA_ACCEL_&/g' )
|
||||
make -C tests libtestdriver1.a CFLAGS="$ASAN_CFLAGS $loc_accel_flags" LDFLAGS="$ASAN_CFLAGS"
|
||||
|
||||
# Restore test driver base configuration
|
||||
scripts/config.py -f tests/include/test/drivers/config_test_driver.h unset MBEDTLS_SHA384_C
|
||||
scripts/config.py -f tests/include/test/drivers/config_test_driver.h unset MBEDTLS_SHA512_C
|
||||
|
||||
scripts/config.py set MBEDTLS_PSA_CRYPTO_DRIVERS
|
||||
scripts/config.py set MBEDTLS_PSA_CRYPTO_CONFIG
|
||||
scripts/config.py unset MBEDTLS_USE_PSA_CRYPTO
|
||||
scripts/config.py unset MBEDTLS_ECDSA_C
|
||||
scripts/config.py unset MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED
|
||||
scripts/config.py unset MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED
|
||||
|
||||
loc_accel_flags="$loc_accel_flags $( echo "$loc_accel_list" | sed 's/[^ ]* */-DMBEDTLS_PSA_ACCEL_&/g' )"
|
||||
make CFLAGS="$ASAN_CFLAGS -O -Werror -I../tests/include -I../tests -DPSA_CRYPTO_DRIVER_TEST -DMBEDTLS_TEST_LIBTESTDRIVER1 $loc_accel_flags" LDFLAGS="-ltestdriver1 $ASAN_CFLAGS"
|
||||
|
||||
unset loc_accel_flags
|
||||
unset loc_accel_list
|
||||
|
||||
if_build_succeeded not grep mbedtls_ecdsa_ library/ecdsa.o
|
||||
|
||||
msg "test: MBEDTLS_PSA_CRYPTO_CONFIG with accelerated ECDSA"
|
||||
make test
|
||||
}
|
||||
|
||||
component_test_psa_crypto_config_accel_rsa_signature () {
|
||||
msg "test: MBEDTLS_PSA_CRYPTO_CONFIG with accelerated RSA signature"
|
||||
|
||||
# Disable ALG_STREAM_CIPHER and ALG_ECB_NO_PADDING to avoid having
|
||||
# partial support for cipher operations in the driver test library.
|
||||
scripts/config.py -f include/psa/crypto_config.h unset PSA_WANT_ALG_STREAM_CIPHER
|
||||
scripts/config.py -f include/psa/crypto_config.h unset PSA_WANT_ALG_ECB_NO_PADDING
|
||||
|
||||
# It seems it is not possible to remove only the support for RSA signature
|
||||
# in the library. Thus we have to remove all RSA support (signature and
|
||||
# encryption/decryption). AS there is no driver support for asymmetric
|
||||
# encryption/decryption so far remove RSA encryption/decryption from the
|
||||
# application algorithm list.
|
||||
scripts/config.py -f include/psa/crypto_config.h unset PSA_WANT_ALG_RSA_OAEP
|
||||
scripts/config.py -f include/psa/crypto_config.h unset PSA_WANT_ALG_RSA_PKCS1V15_CRYPT
|
||||
|
||||
# Make sure both the library and the test library support the SHA hash
|
||||
# algorithms and only those ones (SHA256 is included by default). That way:
|
||||
# - the test library can compute the RSA signatures even in the case of a
|
||||
# composite RSA signature algorithm based on a SHA hash (no other hash
|
||||
# used in the unit tests).
|
||||
# - the dependency of RSA signature tests on PSA_WANT_ALG_SHA_xyz is
|
||||
# fulfilled as the hash SHA algorithm is supported by the library, and
|
||||
# thus the tests are run, not skipped.
|
||||
# - when testing a signature key with an algorithm wildcard built from
|
||||
# PSA_ALG_ANY_HASH as algorithm to test with the key, the chosen hash
|
||||
# algorithm based on the hashes supported by the library is also
|
||||
# supported by the test library.
|
||||
scripts/config.py -f include/psa/crypto_config.h unset PSA_WANT_ALG_MD5
|
||||
scripts/config.py -f include/psa/crypto_config.h unset PSA_WANT_ALG_RIPEMD160_C
|
||||
|
||||
scripts/config.py -f tests/include/test/drivers/config_test_driver.h set MBEDTLS_SHA1_C
|
||||
scripts/config.py -f tests/include/test/drivers/config_test_driver.h set MBEDTLS_SHA512_C
|
||||
# We need PEM parsing in the test library as well to support the import
|
||||
# of PEM encoded RSA keys.
|
||||
scripts/config.py -f tests/include/test/drivers/config_test_driver.h set MBEDTLS_PEM_PARSE_C
|
||||
scripts/config.py -f tests/include/test/drivers/config_test_driver.h set MBEDTLS_BASE64_C
|
||||
|
||||
loc_accel_list="ALG_RSA_PKCS1V15_SIGN ALG_RSA_PSS KEY_TYPE_RSA_KEY_PAIR KEY_TYPE_RSA_PUBLIC_KEY"
|
||||
loc_accel_flags=$( echo "$loc_accel_list" | sed 's/[^ ]* */-DLIBTESTDRIVER1_MBEDTLS_PSA_ACCEL_&/g' )
|
||||
make -C tests libtestdriver1.a CFLAGS="$ASAN_CFLAGS $loc_accel_flags" LDFLAGS="$ASAN_CFLAGS"
|
||||
|
||||
# Restore test driver base configuration
|
||||
scripts/config.py -f tests/include/test/drivers/config_test_driver.h unset MBEDTLS_SHA1_C
|
||||
scripts/config.py -f tests/include/test/drivers/config_test_driver.h unset MBEDTLS_SHA512_C
|
||||
scripts/config.py -f tests/include/test/drivers/config_test_driver.h unset MBEDTLS_PEM_PARSE_C
|
||||
scripts/config.py -f tests/include/test/drivers/config_test_driver.h unset MBEDTLS_BASE64_C
|
||||
|
||||
|
||||
# Mbed TLS library build
|
||||
scripts/config.py set MBEDTLS_PSA_CRYPTO_DRIVERS
|
||||
scripts/config.py set MBEDTLS_PSA_CRYPTO_CONFIG
|
||||
|
||||
# Remove RSA support and its dependencies
|
||||
scripts/config.py unset MBEDTLS_PKCS1_V15
|
||||
scripts/config.py unset MBEDTLS_PKCS1_V21
|
||||
scripts/config.py unset MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED
|
||||
scripts/config.py unset MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED
|
||||
scripts/config.py unset MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED
|
||||
scripts/config.py unset MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED
|
||||
scripts/config.py unset MBEDTLS_KEY_EXCHANGE_RSA_ENABLED
|
||||
scripts/config.py unset MBEDTLS_RSA_C
|
||||
scripts/config.py unset MBEDTLS_X509_RSASSA_PSS_SUPPORT
|
||||
|
||||
scripts/config.py unset MBEDTLS_MD5_C
|
||||
scripts/config.py unset MBEDTLS_RIPEMD160_C
|
||||
scripts/config.py unset MBEDTLS_SSL_PROTO_TLS1
|
||||
scripts/config.py unset MBEDTLS_SSL_PROTO_TLS1_1
|
||||
scripts/config.py unset MBEDTLS_SSL_CBC_RECORD_SPLITTING
|
||||
|
||||
loc_accel_flags="$loc_accel_flags $( echo "$loc_accel_list" | sed 's/[^ ]* */-DMBEDTLS_PSA_ACCEL_&/g' )"
|
||||
make CFLAGS="$ASAN_CFLAGS -Werror -I../tests/include -I../tests -DPSA_CRYPTO_DRIVER_TEST -DMBEDTLS_TEST_LIBTESTDRIVER1 $loc_accel_flags" LDFLAGS="-ltestdriver1 $ASAN_CFLAGS"
|
||||
|
||||
unset loc_accel_flags
|
||||
unset loc_accel_list
|
||||
|
||||
if_build_succeeded not grep mbedtls_rsa_rsassa_pkcs1_v15_sign library/rsa.o
|
||||
if_build_succeeded not grep mbedtls_rsa_rsassa_pss_sign_ext library/rsa.o
|
||||
|
||||
msg "test: MBEDTLS_PSA_CRYPTO_CONFIG with accelerated RSA signature"
|
||||
make test
|
||||
}
|
||||
|
||||
component_test_psa_crypto_config_accel_hash () {
|
||||
msg "test: MBEDTLS_PSA_CRYPTO_CONFIG with accelerated hash"
|
||||
|
||||
# Disable ALG_STREAM_CIPHER and ALG_ECB_NO_PADDING to avoid having
|
||||
# partial support for cipher operations in the driver test library.
|
||||
scripts/config.py -f include/psa/crypto_config.h unset PSA_WANT_ALG_STREAM_CIPHER
|
||||
scripts/config.py -f include/psa/crypto_config.h unset PSA_WANT_ALG_ECB_NO_PADDING
|
||||
|
||||
loc_accel_list="ALG_MD5 ALG_RIPEMD160 ALG_SHA_1 ALG_SHA_224 ALG_SHA_256 ALG_SHA_384 ALG_SHA_512"
|
||||
loc_accel_flags=$( echo "$loc_accel_list" | sed 's/[^ ]* */-DLIBTESTDRIVER1_MBEDTLS_PSA_ACCEL_&/g' )
|
||||
make -C tests libtestdriver1.a CFLAGS="$ASAN_CFLAGS $loc_accel_flags" LDFLAGS="$ASAN_CFLAGS"
|
||||
|
||||
scripts/config.py set MBEDTLS_PSA_CRYPTO_DRIVERS
|
||||
scripts/config.py set MBEDTLS_PSA_CRYPTO_CONFIG
|
||||
scripts/config.py unset MBEDTLS_MD5_C
|
||||
scripts/config.py unset MBEDTLS_RIPEMD160_C
|
||||
scripts/config.py unset MBEDTLS_SHA1_C
|
||||
# Don't unset MBEDTLS_SHA256_C as it is needed by PSA crypto core.
|
||||
scripts/config.py unset MBEDTLS_SHA384_C
|
||||
scripts/config.py unset MBEDTLS_SHA512_C
|
||||
# Unset MBEDTLS_SSL_PROTO_SSL3, MBEDTLS_SSL_PROTO_TLS1 and MBEDTLS_SSL_PROTO_TLS1_1 as they depend on MBEDTLS_SHA1_C
|
||||
scripts/config.py unset MBEDTLS_SSL_PROTO_SSL3
|
||||
scripts/config.py unset MBEDTLS_SSL_PROTO_TLS1
|
||||
scripts/config.py unset MBEDTLS_SSL_PROTO_TLS1_1
|
||||
# Unset MBEDTLS_SSL_CBC_RECORD_SPLITTING as it depends on MBEDTLS_SSL_PROTO_TLS1 in the default configuration.
|
||||
scripts/config.py unset MBEDTLS_SSL_CBC_RECORD_SPLITTING
|
||||
loc_accel_flags="$loc_accel_flags $( echo "$loc_accel_list" | sed 's/[^ ]* */-DMBEDTLS_PSA_ACCEL_&/g' )"
|
||||
make CFLAGS="$ASAN_CFLAGS -Werror -I../tests/include -I../tests -DPSA_CRYPTO_DRIVER_TEST -DMBEDTLS_TEST_LIBTESTDRIVER1 $loc_accel_flags" LDFLAGS="-ltestdriver1 $ASAN_CFLAGS"
|
||||
|
||||
unset loc_accel_flags
|
||||
unset loc_accel_list
|
||||
|
||||
if_build_succeeded not grep mbedtls_sha512_init library/sha512.o
|
||||
if_build_succeeded not grep mbedtls_sha1_init library/sha1.o
|
||||
|
||||
msg "test: MBEDTLS_PSA_CRYPTO_CONFIG with accelerated hash"
|
||||
make test
|
||||
}
|
||||
|
||||
component_test_psa_crypto_config_accel_cipher () {
|
||||
msg "test: MBEDTLS_PSA_CRYPTO_CONFIG with accelerated cipher"
|
||||
|
||||
loc_accel_list="ALG_CBC_NO_PADDING ALG_CBC_PKCS7 ALG_CTR ALG_CFB ALG_OFB ALG_XTS KEY_TYPE_DES"
|
||||
loc_accel_flags=$( echo "$loc_accel_list" | sed 's/[^ ]* */-DLIBTESTDRIVER1_MBEDTLS_PSA_ACCEL_&/g' )
|
||||
make -C tests libtestdriver1.a CFLAGS="$ASAN_CFLAGS $loc_accel_flags" LDFLAGS="$ASAN_CFLAGS"
|
||||
|
||||
scripts/config.py set MBEDTLS_PSA_CRYPTO_DRIVERS
|
||||
scripts/config.py set MBEDTLS_PSA_CRYPTO_CONFIG
|
||||
|
||||
# There is no intended accelerator support for ALG STREAM_CIPHER and
|
||||
# ALG_ECB_NO_PADDING. Therefore, asking for them in the build implies the
|
||||
@ -1570,26 +1731,25 @@ component_test_psa_crypto_config_basic() {
|
||||
# PSA configuration options.
|
||||
scripts/config.py -f include/psa/crypto_config.h unset PSA_WANT_ALG_STREAM_CIPHER
|
||||
scripts/config.py -f include/psa/crypto_config.h unset PSA_WANT_ALG_ECB_NO_PADDING
|
||||
scripts/config.py -f include/psa/crypto_config.h unset PSA_WANT_ALG_CMAC
|
||||
|
||||
# Don't test DES encryption as:
|
||||
# 1) It is not an issue if we don't test all cipher types here.
|
||||
# 2) That way we don't have to modify in psa_crypto.c the compilation
|
||||
# guards MBEDTLS_PSA_BUILTIN_KEY_TYPE_DES for the code they guard to be
|
||||
# available to the test driver. Modifications that we would need to
|
||||
# revert when we move to compile the test driver separately.
|
||||
# We also disable MBEDTLS_DES_C as the dependencies on DES in PSA test
|
||||
# suites are still based on MBEDTLS_DES_C and not PSA_WANT_KEY_TYPE_DES.
|
||||
scripts/config.py -f include/psa/crypto_config.h unset PSA_WANT_KEY_TYPE_DES
|
||||
scripts/config.py unset MBEDTLS_CIPHER_MODE_CBC
|
||||
scripts/config.py unset MBEDTLS_CIPHER_PADDING_PKCS7
|
||||
scripts/config.py unset MBEDTLS_CIPHER_MODE_CTR
|
||||
scripts/config.py unset MBEDTLS_CIPHER_MODE_CFB
|
||||
scripts/config.py unset MBEDTLS_CIPHER_MODE_OFB
|
||||
scripts/config.py unset MBEDTLS_CIPHER_MODE_XTS
|
||||
scripts/config.py unset MBEDTLS_DES_C
|
||||
|
||||
loc_cflags="$ASAN_CFLAGS -DPSA_CRYPTO_DRIVER_TEST_ALL"
|
||||
loc_cflags="${loc_cflags} '-DMBEDTLS_USER_CONFIG_FILE=\"../tests/configs/user-config-for-test.h\"'"
|
||||
loc_cflags="${loc_cflags} -I../tests/include -O2"
|
||||
loc_accel_flags="$loc_accel_flags $( echo "$loc_accel_list" | sed 's/[^ ]* */-DMBEDTLS_PSA_ACCEL_&/g' )"
|
||||
make CFLAGS="$ASAN_CFLAGS -Werror -I../tests/include -I../tests -DPSA_CRYPTO_DRIVER_TEST -DMBEDTLS_TEST_LIBTESTDRIVER1 $loc_accel_flags" LDFLAGS="-ltestdriver1 $ASAN_CFLAGS"
|
||||
|
||||
make CC=gcc CFLAGS="$loc_cflags" LDFLAGS="$ASAN_CFLAGS"
|
||||
unset loc_cflags
|
||||
unset loc_accel_flags
|
||||
unset loc_accel_list
|
||||
|
||||
msg "test: full + MBEDTLS_PSA_CRYPTO_CONFIG"
|
||||
if_build_succeeded not grep mbedtls_des* library/des.o
|
||||
|
||||
msg "test: MBEDTLS_PSA_CRYPTO_CONFIG with accelerated hash"
|
||||
make test
|
||||
}
|
||||
|
||||
|
||||
@ -779,7 +779,8 @@ class NameChecker():
|
||||
match.name
|
||||
for match
|
||||
in self.parse_result["macros"] + self.parse_result["enum_consts"]}
|
||||
typo_exclusion = re.compile(r"XXX|__|_$|^MBEDTLS_.*CONFIG_FILE$")
|
||||
typo_exclusion = re.compile(r"XXX|__|_$|^MBEDTLS_.*CONFIG_FILE$|"
|
||||
r"MBEDTLS_TEST_LIBTESTDRIVER*")
|
||||
|
||||
for name_match in self.parse_result["mbed_words"]:
|
||||
found = name_match.name in all_caps_names
|
||||
|
||||
Reference in New Issue
Block a user